Read the docs
TI-2026-85147 Aliases CVE-2026-113371GHSA-ww65-8rp8-7fpw

Sonatype Nexus Repository 3 exposes APT and YUM signing passphrases

Priority LOW 31CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Sonatype Nexus Repository 3 from 3.93.0 before 3.98.0 returns the signing passphrase of APT and YUM repositories to users, due to insufficiently protected credentials (CWE-522). A remote user with low privileges and only the read privilege for administering a repository can retrieve its signing passphrase, without needing the privilege to edit that repository.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.

Why it matters now

EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.98.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository 33.93.0 to before 3.98.03.98.0Patch availableCNA
  • Nexus Repository 3 VendorSonatype Affected 3.93.0 to before 3.98.0 Fixed in 3.98.0 Patch available CNA

CPE names CNA · 18

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*3.93.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*3.93.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*3.93.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*3.94.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*3.94.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*3.94.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*3.95.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*3.95.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*3.95.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*3.95.3—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* Versions 3.93.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* Versions 3.93.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* Versions 3.93.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*3.95.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*3.96.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*3.96.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*3.96.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*3.96.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*3.96.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*3.97.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*3.97.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* Versions 3.97.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* Versions 3.97.1 — ·Sonatype

Remediation

Update Sonatype Nexus Repository 3 to version 3.98.0, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.98.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sonatype Nexus Repository 3 3.98.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85149 Disabled Nexus Repository 3 accounts can sign in through single sign-onPriority LOW 39
    • TI-2026-85150 Privilege escalation in Nexus Repository 3 via Rut Auth capabilityPriority LOW 37
    • TI-2026-85146 SQL injection in Nexus Repository 3 reindex search taskPriority LOW 33
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-113371
  2. 2026-11-04 Alias added: GHSA-ww65-8rp8-7fpw
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences